applications of formal verification...symbolic execution is a naturalinteractiveproof paradigm...
Post on 29-Mar-2021
1 Views
Preview:
TRANSCRIPT
KIT – INSTITUT FUR THEORETISCHE INFORMATIK
Applications of Formal VerificationFunctional Verification of Java Programs:Java Dynamic LogicBernhard Beckert · Mattias Ulbrich | SS 2019
KIT – University of the State of Baden-Wurttemberg and National Large-scale Research Center of the Helmholtz Association
1 JAVA CARD DL
2 Sequent Calculus
3 Rules for Programs: Symbolic Execution
4 A Calculus for 100% JAVA CARD
5 Loop Invariants
Beckert, Ulbrich – Applications of Formal Verification SS 2019 2/44
1 JAVA CARD DL
2 Sequent Calculus
3 Rules for Programs: Symbolic Execution
4 A Calculus for 100% JAVA CARD
5 Loop Invariants
Beckert, Ulbrich – Applications of Formal Verification SS 2019 3/44
Syntax and Semantics
SyntaxBasis: Typed first-order predicate logicModal operators 〈p〉 and [p] for each(JAVA CARD) program pClass definitions in background (not shown in formulas)
Semantics (Kripke)
Modal operators allow referring to the final state of p:[p]F : If p terminates normally, then
F holds in the final state (“partial correctness”)〈p〉F : p terminates normally, and
F holds in the final state (“total correctness”)
Beckert, Ulbrich – Applications of Formal Verification SS 2019 4/44
Syntax and Semantics
SyntaxBasis: Typed first-order predicate logicModal operators 〈p〉 and [p] for each(JAVA CARD) program pClass definitions in background (not shown in formulas)
Semantics (Kripke)
Modal operators allow referring to the final state of p:[p]F : If p terminates normally, then
F holds in the final state (“partial correctness”)〈p〉F : p terminates normally, and
F holds in the final state (“total correctness”)
Beckert, Ulbrich – Applications of Formal Verification SS 2019 4/44
Syntax and Semantics
SyntaxBasis: Typed first-order predicate logicModal operators 〈p〉 and [p] for each(JAVA CARD) program pClass definitions in background (not shown in formulas)
Semantics (Kripke)
Modal operators allow referring to the final state of p:[p]F : If p terminates normally, then
F holds in the final state (“partial correctness”)〈p〉F : p terminates normally, and
F holds in the final state (“total correctness”)
Beckert, Ulbrich – Applications of Formal Verification SS 2019 4/44
Syntax and Semantics
SyntaxBasis: Typed first-order predicate logicModal operators 〈p〉 and [p] for each(JAVA CARD) program pClass definitions in background (not shown in formulas)
Semantics (Kripke)
Modal operators allow referring to the final state of p:[p]F : If p terminates normally, then
F holds in the final state (“partial correctness”)〈p〉F : p terminates normally, and
F holds in the final state (“total correctness”)
Beckert, Ulbrich – Applications of Formal Verification SS 2019 4/44
Why Dynamic Logic?
Transparency wrt target programming languageEncompasses Hoare LogicMore expressive and flexible than Hoare logicSymbolic execution is a natural interactive proof paradigm
Programs are “first-class citizens”Real Java syntax
Beckert, Ulbrich – Applications of Formal Verification SS 2019 5/44
Why Dynamic Logic?
Transparency wrt target programming languageEncompasses Hoare LogicMore expressive and flexible than Hoare logicSymbolic execution is a natural interactive proof paradigm
Hoare triple {ψ} α {φ} equiv. to DL formula ψ → [α]φ
Beckert, Ulbrich – Applications of Formal Verification SS 2019 5/44
Why Dynamic Logic?
Transparency wrt target programming languageEncompasses Hoare LogicMore expressive and flexible than Hoare logicSymbolic execution is a natural interactive proof paradigm
Not merely partial/total correctness:can employ programs for specification (e.g., verifyingprogram transformations)can express security properties (two runs areindistinguishable)extension-friendly (e.g., temporal modalities)
Beckert, Ulbrich – Applications of Formal Verification SS 2019 5/44
Why Dynamic Logic?
Transparency wrt target programming languageEncompasses Hoare LogicMore expressive and flexible than Hoare logicSymbolic execution is a natural interactive proof paradigm
Beckert, Ulbrich – Applications of Formal Verification SS 2019 5/44
Dynamic Logic Example Formulas
(balance >= c ∧ amount > 0)→〈charge(amount);〉 balance > c
〈x = 1;〉([while (true) {}]false)
Program formulas can appear nested
\forall int val ;((〈p〉x = val) ←→ (〈q〉x = val)
)p, q equivalent relative to computation state restricted to x
Beckert, Ulbrich – Applications of Formal Verification SS 2019 6/44
Dynamic Logic Example Formulas
(balance >= c ∧ amount > 0)→〈charge(amount);〉 balance > c
〈x = 1;〉([while (true) {}]false)
Program formulas can appear nested
\forall int val ;((〈p〉x = val) ←→ (〈q〉x = val)
)p, q equivalent relative to computation state restricted to x
Beckert, Ulbrich – Applications of Formal Verification SS 2019 6/44
Dynamic Logic Example Formulas
(balance >= c ∧ amount > 0)→〈charge(amount);〉 balance > c
〈x = 1;〉([while (true) {}]false)
Program formulas can appear nested
\forall int val ;((〈p〉x = val) ←→ (〈q〉x = val)
)p, q equivalent relative to computation state restricted to x
Beckert, Ulbrich – Applications of Formal Verification SS 2019 6/44
Dynamic Logic Example Formulas
(balance >= c ∧ amount > 0)→〈charge(amount);〉 balance > c
〈x = 1;〉([while (true) {}]false)
Program formulas can appear nested
\forall int val ;((〈p〉x = val) ←→ (〈q〉x = val)
)p, q equivalent relative to computation state restricted to x
Beckert, Ulbrich – Applications of Formal Verification SS 2019 6/44
Dynamic Logic Example Formulas
(balance >= c ∧ amount > 0)→〈charge(amount);〉 balance > c
〈x = 1;〉([while (true) {}]false)
Program formulas can appear nested
\forall int val ;((〈p〉x = val) ←→ (〈q〉x = val)
)p, q equivalent relative to computation state restricted to x
Beckert, Ulbrich – Applications of Formal Verification SS 2019 6/44
Dynamic Logic Example Formulas
a != null-><int max = 0;if ( a.length > 0 ) max = a[0];int i = 1;while ( i < a.length ) {if ( a[i] > max ) max = a[i];++i;
}>(
\forall int j; (j >= 0 & j < a.length -> max >= a[j])&(a.length > 0 ->\exists int j; (j >= 0 & j < a.length & max = a[j]))
)
Beckert, Ulbrich – Applications of Formal Verification SS 2019 7/44
Variables
Logical variables disjoint from program variables
No quantification over program variablesPrograms do not contain logical variables“Program variables” actually non-rigid functions
Beckert, Ulbrich – Applications of Formal Verification SS 2019 8/44
Validity
A JAVA CARD DL formula is valid iff it is true in all states.
We need a calculus for checking validity of formulas
Beckert, Ulbrich – Applications of Formal Verification SS 2019 9/44
Validity
A JAVA CARD DL formula is valid iff it is true in all states.
We need a calculus for checking validity of formulas
Beckert, Ulbrich – Applications of Formal Verification SS 2019 9/44
1 JAVA CARD DL
2 Sequent Calculus
3 Rules for Programs: Symbolic Execution
4 A Calculus for 100% JAVA CARD
5 Loop Invariants
Beckert, Ulbrich – Applications of Formal Verification SS 2019 10/44
1 JAVA CARD DL
2 Sequent Calculus
3 Rules for Programs: Symbolic Execution
4 A Calculus for 100% JAVA CARD
5 Loop Invariants
Beckert, Ulbrich – Applications of Formal Verification SS 2019 11/44
Sequents and their Semantics
Syntax
ψ1, . . . , ψm︸ ︷︷ ︸Antecedent
=⇒ φ1, . . . , φn︸ ︷︷ ︸Succedent
where the φi , ψi are formulae (without free variables)
Semantics
Same as the formula
(ψ1 ∧ · · · ∧ ψm) → (φ1 ∨ · · · ∨ φn)
Beckert, Ulbrich – Applications of Formal Verification SS 2019 12/44
Sequents and their Semantics
Syntax
ψ1, . . . , ψm︸ ︷︷ ︸Antecedent
=⇒ φ1, . . . , φn︸ ︷︷ ︸Succedent
where the φi , ψi are formulae (without free variables)
Semantics
Same as the formula
(ψ1 ∧ · · · ∧ ψm) → (φ1 ∨ · · · ∨ φn)
Beckert, Ulbrich – Applications of Formal Verification SS 2019 12/44
Sequent Rules
General form
RULE NAME
Premisses︷ ︸︸ ︷Γ1 =⇒ ∆1 · · · Γr =⇒ ∆r
Γ =⇒ ∆︸ ︷︷ ︸Conclusion
(r = 0 possible: closing rules)
SoundnessIf all premisses are valid, then the conclusion is valid
Use in practiceGoal is matched to conclusion
Beckert, Ulbrich – Applications of Formal Verification SS 2019 13/44
Sequent Rules
General form
RULE NAME
Premisses︷ ︸︸ ︷Γ1 =⇒ ∆1 · · · Γr =⇒ ∆r
Γ =⇒ ∆︸ ︷︷ ︸Conclusion
(r = 0 possible: closing rules)
SoundnessIf all premisses are valid, then the conclusion is valid
Use in practiceGoal is matched to conclusion
Beckert, Ulbrich – Applications of Formal Verification SS 2019 13/44
Sequent Rules
General form
RULE NAME
Premisses︷ ︸︸ ︷Γ1 =⇒ ∆1 · · · Γr =⇒ ∆r
Γ =⇒ ∆︸ ︷︷ ︸Conclusion
(r = 0 possible: closing rules)
SoundnessIf all premisses are valid, then the conclusion is valid
Use in practiceGoal is matched to conclusion
Beckert, Ulbrich – Applications of Formal Verification SS 2019 13/44
Sequent Rules
General form
RULE NAME
Premisses︷ ︸︸ ︷Γ1 =⇒ ∆1 · · · Γr =⇒ ∆r
Γ =⇒ ∆︸ ︷︷ ︸Conclusion
(r = 0 possible: closing rules)
SoundnessIf all premisses are valid, then the conclusion is valid
Use in practiceGoal is matched to conclusion
Beckert, Ulbrich – Applications of Formal Verification SS 2019 13/44
Some Simple Sequent Rules
NOT LEFTΓ =⇒ A,∆
Γ,¬A =⇒ ∆
IMP LEFTΓ =⇒ A,∆ Γ,B =⇒ ∆
Γ,A→ B =⇒ ∆
CLOSE GOALΓ,A =⇒ A,∆
CLOSE BY TRUEΓ =⇒ true,∆
ALL LEFTΓ, \forall t x ;φ, {x/e}φ =⇒ ∆
Γ, \forall t x ;φ =⇒ ∆
where e var-free term of type t ′ ≺ t
Beckert, Ulbrich – Applications of Formal Verification SS 2019 14/44
Some Simple Sequent Rules
NOT LEFTΓ =⇒ A,∆
Γ,¬A =⇒ ∆
IMP LEFTΓ =⇒ A,∆ Γ,B =⇒ ∆
Γ,A→ B =⇒ ∆
CLOSE GOALΓ,A =⇒ A,∆
CLOSE BY TRUEΓ =⇒ true,∆
ALL LEFTΓ, \forall t x ;φ, {x/e}φ =⇒ ∆
Γ, \forall t x ;φ =⇒ ∆
where e var-free term of type t ′ ≺ t
Beckert, Ulbrich – Applications of Formal Verification SS 2019 14/44
Some Simple Sequent Rules
NOT LEFTΓ =⇒ A,∆
Γ,¬A =⇒ ∆
IMP LEFTΓ =⇒ A,∆ Γ,B =⇒ ∆
Γ,A→ B =⇒ ∆
CLOSE GOALΓ,A =⇒ A,∆
CLOSE BY TRUEΓ =⇒ true,∆
ALL LEFTΓ, \forall t x ;φ, {x/e}φ =⇒ ∆
Γ, \forall t x ;φ =⇒ ∆
where e var-free term of type t ′ ≺ t
Beckert, Ulbrich – Applications of Formal Verification SS 2019 14/44
Some Simple Sequent Rules
NOT LEFTΓ =⇒ A,∆
Γ,¬A =⇒ ∆
IMP LEFTΓ =⇒ A,∆ Γ,B =⇒ ∆
Γ,A→ B =⇒ ∆
CLOSE GOALΓ,A =⇒ A,∆
CLOSE BY TRUEΓ =⇒ true,∆
ALL LEFTΓ, \forall t x ;φ, {x/e}φ =⇒ ∆
Γ, \forall t x ;φ =⇒ ∆
where e var-free term of type t ′ ≺ t
Beckert, Ulbrich – Applications of Formal Verification SS 2019 14/44
Some Simple Sequent Rules
NOT LEFTΓ =⇒ A,∆
Γ,¬A =⇒ ∆
IMP LEFTΓ =⇒ A,∆ Γ,B =⇒ ∆
Γ,A→ B =⇒ ∆
CLOSE GOALΓ,A =⇒ A,∆
CLOSE BY TRUEΓ =⇒ true,∆
ALL LEFTΓ, \forall t x ;φ, {x/e}φ =⇒ ∆
Γ, \forall t x ;φ =⇒ ∆
where e var-free term of type t ′ ≺ t
Beckert, Ulbrich – Applications of Formal Verification SS 2019 14/44
Sequent Calculus Proofs
Proof treeProof is tree structure withgoal sequent as rootRules are appliedfrom conclusion (old goal)to premisses (new goals)Rule with no premiss closes proofbranchProof is finished when all goals areclosed
Beckert, Ulbrich – Applications of Formal Verification SS 2019 15/44
Sequent Calculus Proofs
Proof treeProof is tree structure withgoal sequent as rootRules are appliedfrom conclusion (old goal)to premisses (new goals)Rule with no premiss closes proofbranchProof is finished when all goals areclosed
Beckert, Ulbrich – Applications of Formal Verification SS 2019 15/44
Sequent Calculus Proofs
Proof treeProof is tree structure withgoal sequent as rootRules are appliedfrom conclusion (old goal)to premisses (new goals)Rule with no premiss closes proofbranchProof is finished when all goals areclosed
Beckert, Ulbrich – Applications of Formal Verification SS 2019 15/44
Sequent Calculus Proofs
Proof treeProof is tree structure withgoal sequent as rootRules are appliedfrom conclusion (old goal)to premisses (new goals)Rule with no premiss closes proofbranchProof is finished when all goals areclosed
Beckert, Ulbrich – Applications of Formal Verification SS 2019 15/44
1 JAVA CARD DL
2 Sequent Calculus
3 Rules for Programs: Symbolic Execution
4 A Calculus for 100% JAVA CARD
5 Loop Invariants
Beckert, Ulbrich – Applications of Formal Verification SS 2019 16/44
1 JAVA CARD DL
2 Sequent Calculus
3 Rules for Programs: Symbolic Execution
4 A Calculus for 100% JAVA CARD
5 Loop Invariants
Beckert, Ulbrich – Applications of Formal Verification SS 2019 17/44
Proof by Symbolic ProgramExecution
Sequent rules for program formulas?What corresponds to top-level connective in a program?
The Active Statement in a Program
Sequent rules execute symbolically the active statement
Beckert, Ulbrich – Applications of Formal Verification SS 2019 18/44
Proof by Symbolic ProgramExecution
Sequent rules for program formulas?What corresponds to top-level connective in a program?
The Active Statement in a Program
l:{try{ i=0; j=0; } finally{ k=0; }}
Sequent rules execute symbolically the active statement
Beckert, Ulbrich – Applications of Formal Verification SS 2019 18/44
Proof by Symbolic ProgramExecution
Sequent rules for program formulas?What corresponds to top-level connective in a program?
The Active Statement in a Program
l:{try{ i=0; j=0; } finally{ k=0; }}
Sequent rules execute symbolically the active statement
Beckert, Ulbrich – Applications of Formal Verification SS 2019 18/44
Proof by Symbolic ProgramExecution
Sequent rules for program formulas?What corresponds to top-level connective in a program?
The Active Statement in a Program
l:{try{︸ ︷︷ ︸π
i=0; j=0; } finally{ k=0; }}︸ ︷︷ ︸ω
passive prefix πactive statement i=0;rest ω
Sequent rules execute symbolically the active statement
Beckert, Ulbrich – Applications of Formal Verification SS 2019 18/44
Proof by Symbolic ProgramExecution
Sequent rules for program formulas?What corresponds to top-level connective in a program?
The Active Statement in a Program
l:{try{︸ ︷︷ ︸π
i=0; j=0; } finally{ k=0; }}︸ ︷︷ ︸ω
passive prefix πactive statement i=0;rest ω
Sequent rules execute symbolically the active statement
Beckert, Ulbrich – Applications of Formal Verification SS 2019 18/44
Rules for Symbolic ProgramExecution
If-then-else rule
Γ,B = true =⇒ 〈p ω〉φ,∆ Γ,B = false =⇒ 〈q ω〉φ,∆Γ =⇒ 〈if (B) { p } else { q } ω〉φ,∆
Complicated statements/expressions are simplified first,e.g.
Γ =⇒ 〈v=y; y=y+1; x=v; ω〉φ,∆Γ =⇒ 〈x=y++; ω〉φ,∆
Simple assignment rule
Γ =⇒ {loc := val}〈ω〉φ,∆Γ =⇒ 〈loc=val; ω〉φ,∆
Beckert, Ulbrich – Applications of Formal Verification SS 2019 19/44
Rules for Symbolic ProgramExecution
If-then-else rule
Γ,B = true =⇒ 〈p ω〉φ,∆ Γ,B = false =⇒ 〈q ω〉φ,∆Γ =⇒ 〈if (B) { p } else { q } ω〉φ,∆
Complicated statements/expressions are simplified first,e.g.
Γ =⇒ 〈v=y; y=y+1; x=v; ω〉φ,∆Γ =⇒ 〈x=y++; ω〉φ,∆
Simple assignment rule
Γ =⇒ {loc := val}〈ω〉φ,∆Γ =⇒ 〈loc=val; ω〉φ,∆
Beckert, Ulbrich – Applications of Formal Verification SS 2019 19/44
Rules for Symbolic ProgramExecution
If-then-else rule
Γ,B = true =⇒ 〈p ω〉φ,∆ Γ,B = false =⇒ 〈q ω〉φ,∆Γ =⇒ 〈if (B) { p } else { q } ω〉φ,∆
Complicated statements/expressions are simplified first,e.g.
Γ =⇒ 〈v=y; y=y+1; x=v; ω〉φ,∆Γ =⇒ 〈x=y++; ω〉φ,∆
Simple assignment rule
Γ =⇒ {loc := val}〈ω〉φ,∆Γ =⇒ 〈loc=val; ω〉φ,∆
Beckert, Ulbrich – Applications of Formal Verification SS 2019 19/44
Treating Assignment with “Updates”
Updatessyntactic elements in the logic – (explicit substitutions)
Elementary Updates
{loc := val}φ
whereloc is a program variableval is an expression type-compatible with loc
Parallel Updates
{loc1 := t1 || · · · || locn := tn}φ
no dependency between the n components (but ‘last wins’semantics)
Beckert, Ulbrich – Applications of Formal Verification SS 2019 20/44
Treating Assignment with “Updates”
Updatessyntactic elements in the logic – (explicit substitutions)
Elementary Updates
{loc := val}φ
whereloc is a program variableval is an expression type-compatible with loc
Parallel Updates
{loc1 := t1 || · · · || locn := tn}φ
no dependency between the n components (but ‘last wins’semantics)
Beckert, Ulbrich – Applications of Formal Verification SS 2019 20/44
Treating Assignment with “Updates”
Updatessyntactic elements in the logic – (explicit substitutions)
Elementary Updates
{loc := val}φ
whereloc is a program variableval is an expression type-compatible with loc
Parallel Updates
{loc1 := t1 || · · · || locn := tn}φ
no dependency between the n components (but ‘last wins’semantics)
Beckert, Ulbrich – Applications of Formal Verification SS 2019 20/44
Why Updates?
Updates areaggregations of state changeeagerly parallelised + simplifiedlazily applied (i.e., substituted into postcondition)
Advantagesno renaming required(compared to another forward proof technique:strongest-postcondition calculus)
delayed/minimised proof branchingefficient aliasing treatment)
Beckert, Ulbrich – Applications of Formal Verification SS 2019 21/44
Why Updates?
Updates areaggregations of state changeeagerly parallelised + simplifiedlazily applied (i.e., substituted into postcondition)
Advantagesno renaming required(compared to another forward proof technique:strongest-postcondition calculus)
delayed/minimised proof branchingefficient aliasing treatment)
Beckert, Ulbrich – Applications of Formal Verification SS 2019 21/44
Symbolic Execution with Updates(by Example)
x < y =⇒ x < y...
x < y =⇒ {x:=y || y:=x}〈〉 y < x...
x < y =⇒ {t:=x || x:=y || y:=x}〈〉 y < x...
x < y =⇒ {t:=x || x:=y}{y:=t}〈〉 y < x...
x < y =⇒ {t:=x}{x:=y}〈y=t;〉 y < x...
x < y =⇒ {t:=x}〈x=y; y=t;〉 y < x...
=⇒ x < y→ 〈int t=x; x=y; y=t;〉 y < x
Beckert, Ulbrich – Applications of Formal Verification SS 2019 22/44
Symbolic Execution with Updates(by Example)
x < y =⇒ x < y...
x < y =⇒ {x:=y || y:=x}〈〉 y < x...
x < y =⇒ {t:=x || x:=y || y:=x}〈〉 y < x...
x < y =⇒ {t:=x || x:=y}{y:=t}〈〉 y < x...
x < y =⇒ {t:=x}{x:=y}〈y=t;〉 y < x...
x < y =⇒ {t:=x}〈x=y; y=t;〉 y < x...
=⇒ x < y→ 〈int t=x; x=y; y=t;〉 y < x
Beckert, Ulbrich – Applications of Formal Verification SS 2019 22/44
Symbolic Execution with Updates(by Example)
x < y =⇒ x < y...
x < y =⇒ {x:=y || y:=x}〈〉 y < x...
x < y =⇒ {t:=x || x:=y || y:=x}〈〉 y < x...
x < y =⇒ {t:=x || x:=y}{y:=t}〈〉 y < x...
x < y =⇒ {t:=x}{x:=y}〈y=t;〉 y < x...
x < y =⇒ {t:=x}〈x=y; y=t;〉 y < x...
=⇒ x < y→ 〈int t=x; x=y; y=t;〉 y < x
Beckert, Ulbrich – Applications of Formal Verification SS 2019 22/44
Symbolic Execution with Updates(by Example)
x < y =⇒ x < y...
x < y =⇒ {x:=y || y:=x}〈〉 y < x...
x < y =⇒ {t:=x || x:=y || y:=x}〈〉 y < x...
x < y =⇒ {t:=x || x:=y}{y:=t}〈〉 y < x...
x < y =⇒ {t:=x}{x:=y}〈y=t;〉 y < x...
x < y =⇒ {t:=x}〈x=y; y=t;〉 y < x...
=⇒ x < y→ 〈int t=x; x=y; y=t;〉 y < x
Beckert, Ulbrich – Applications of Formal Verification SS 2019 22/44
Symbolic Execution with Updates(by Example)
x < y =⇒ x < y...
x < y =⇒ {x:=y || y:=x}〈〉 y < x...
x < y =⇒ {t:=x || x:=y || y:=x}〈〉 y < x...
x < y =⇒ {t:=x || x:=y}{y:=t}〈〉 y < x...
x < y =⇒ {t:=x}{x:=y}〈y=t;〉 y < x...
x < y =⇒ {t:=x}〈x=y; y=t;〉 y < x...
=⇒ x < y→ 〈int t=x; x=y; y=t;〉 y < x
Beckert, Ulbrich – Applications of Formal Verification SS 2019 22/44
Symbolic Execution with Updates(by Example)
x < y =⇒ x < y...
x < y =⇒ {x:=y || y:=x}〈〉 y < x...
x < y =⇒ {t:=x || x:=y || y:=x}〈〉 y < x...
x < y =⇒ {t:=x || x:=y}{y:=t}〈〉 y < x...
x < y =⇒ {t:=x}{x:=y}〈y=t;〉 y < x...
x < y =⇒ {t:=x}〈x=y; y=t;〉 y < x...
=⇒ x < y→ 〈int t=x; x=y; y=t;〉 y < x
Beckert, Ulbrich – Applications of Formal Verification SS 2019 22/44
Symbolic Execution with Updates(by Example)
x < y =⇒ x < y...
x < y =⇒ {x:=y || y:=x}〈〉 y < x...
x < y =⇒ {t:=x || x:=y || y:=x}〈〉 y < x...
x < y =⇒ {t:=x || x:=y}{y:=t}〈〉 y < x...
x < y =⇒ {t:=x}{x:=y}〈y=t;〉 y < x...
x < y =⇒ {t:=x}〈x=y; y=t;〉 y < x...
=⇒ x < y→ 〈int t=x; x=y; y=t;〉 y < x
Beckert, Ulbrich – Applications of Formal Verification SS 2019 22/44
The theory of arrays
An abstract datatype Array(I,V)Types: Indices I, Values V
Function symbols:select : Array(I,V)× I→ Vstore : Array(I,V)× I× V→ Array(I,V)
Axioms∀a, i , v . select(store(a, i , v), i) = v∀a, i , j , v . i 6= j → select(store(a, i , v), j) = select(a, j)
IntuitionD(Array(I,V)) represents the set of functions D(I)→ D(V)
Beckert, Ulbrich – Applications of Formal Verification SS 2019 23/44
The theory of arrays
An abstract datatype Array(I,V)Types: Indices I, Values V
Function symbols:select : Array(I,V)× I→ Vstore : Array(I,V)× I× V→ Array(I,V)
Axioms∀a, i , v . select(store(a, i , v), i) = v∀a, i , j , v . i 6= j → select(store(a, i , v), j) = select(a, j)
IntuitionD(Array(I,V)) represents the set of functions D(I)→ D(V)
Beckert, Ulbrich – Applications of Formal Verification SS 2019 23/44
The theory of arrays
An abstract datatype Array(I,V)Types: Indices I, Values V
Function symbols:select : Array(I,V)× I→ Vstore : Array(I,V)× I× V→ Array(I,V)
Axioms∀a, i , v . select(store(a, i , v), i) = v∀a, i , j , v . i 6= j → select(store(a, i , v), j) = select(a, j)
IntuitionD(Array(I,V)) represents the set of functions D(I)→ D(V)
Beckert, Ulbrich – Applications of Formal Verification SS 2019 23/44
The theory of arrays
An abstract datatype Array(I,V)Types: Indices I, Values V
Function symbols:select : Array(I,V)× I→ Vstore : Array(I,V)× I× V→ Array(I,V)
Axioms∀a, i , v . select(store(a, i , v), i) = v∀a, i , j , v . i 6= j → select(store(a, i , v), j) = select(a, j)
IntuitionD(Array(I,V)) represents the set of functions D(I)→ D(V)
Beckert, Ulbrich – Applications of Formal Verification SS 2019 23/44
Photo by “null0” (www.flickr.com/photos/null0/272015955)
John McCarthy (1927–2011):Theory of arrays is decidable
Program State Representation
Local program variablesModeled as non-rigid constants
HeapModeled with theory of arrays: I = Object × Field , V = Any
heap : Heap (the heap in the current state)select : Heap ×Object × Field → Anystore : Heap ×Object × Field × Any → Heap
Some special program variables
self the current receiver object (this in Java)exc the currently active exception (null if none thrown)result the result of the method invocation
Beckert, Ulbrich – Applications of Formal Verification SS 2019 24/44
Program State Representation
Local program variablesModeled as non-rigid constants
HeapModeled with theory of arrays: I = Object × Field , V = Any
heap : Heap (the heap in the current state)select : Heap ×Object × Field → Anystore : Heap ×Object × Field × Any → Heap
Some special program variables
self the current receiver object (this in Java)exc the currently active exception (null if none thrown)result the result of the method invocation
Beckert, Ulbrich – Applications of Formal Verification SS 2019 24/44
Program State Representation
Local program variablesModeled as non-rigid constants
HeapModeled with theory of arrays: I = Object × Field , V = Any
heap : Heap (the heap in the current state)select : Heap ×Object × Field → Anystore : Heap ×Object × Field × Any → Heap
Some special program variables
self the current receiver object (this in Java)exc the currently active exception (null if none thrown)result the result of the method invocation
Beckert, Ulbrich – Applications of Formal Verification SS 2019 24/44
1 JAVA CARD DL
2 Sequent Calculus
3 Rules for Programs: Symbolic Execution
4 A Calculus for 100% JAVA CARD
5 Loop Invariants
Beckert, Ulbrich – Applications of Formal Verification SS 2019 25/44
1 JAVA CARD DL
2 Sequent Calculus
3 Rules for Programs: Symbolic Execution
4 A Calculus for 100% JAVA CARD
5 Loop Invariants
Beckert, Ulbrich – Applications of Formal Verification SS 2019 26/44
Supported Java Features
method invocation with polymorphism/dynamic bindingobject creation and initialisationarraysabrupt terminationthrowing of NullPointerExceptions, etc.bounded integer data typestransactions
All JAVA CARD language features are fully addressed in KeY
Beckert, Ulbrich – Applications of Formal Verification SS 2019 27/44
Supported Java Features
method invocation with polymorphism/dynamic bindingobject creation and initialisationarraysabrupt terminationthrowing of NullPointerExceptions, etc.bounded integer data typestransactions
All JAVA CARD language features are fully addressed in KeY
Beckert, Ulbrich – Applications of Formal Verification SS 2019 27/44
Java—A Language of Many Features
Ways to deal with Java featuresProgram transformation, up-frontLocal program transformation, done by a rule on-the-flyModeling with first-order formulasSpecial-purpose extensions of program logic
Pro: Feature needs not be handled in calculusContra: Modified source codeExample in KeY: Very rare: treating inner classes
Beckert, Ulbrich – Applications of Formal Verification SS 2019 28/44
Java—A Language of Many Features
Ways to deal with Java featuresProgram transformation, up-frontLocal program transformation, done by a rule on-the-flyModeling with first-order formulasSpecial-purpose extensions of program logic
Pro: Flexible, easy to implement, usableContra: Not expressive enough for all featuresExample in KeY: Complex expression eval, method inlining,etc., etc.
Beckert, Ulbrich – Applications of Formal Verification SS 2019 28/44
Java—A Language of Many Features
Ways to deal with Java featuresProgram transformation, up-frontLocal program transformation, done by a rule on-the-flyModeling with first-order formulasSpecial-purpose extensions of program logic
Pro: No logic extensions required, enough to express mostfeaturesContra: Creates difficult first-order POs, unreadableantecedentsExample in KeY: Dynamic types and branch predicates
Beckert, Ulbrich – Applications of Formal Verification SS 2019 28/44
Java—A Language of Many Features
Ways to deal with Java featuresProgram transformation, up-frontLocal program transformation, done by a rule on-the-flyModeling with first-order formulasSpecial-purpose extensions of program logic
Pro: Arbitrarily expressive extensions possibleContra: Increases complexity of all rulesExample in KeY: Method frames, updates
Beckert, Ulbrich – Applications of Formal Verification SS 2019 28/44
Components of the Calculus
1 Non-program rulesfirst-order rulesrules for data-typesfirst-order modal rulesinduction rules
2 Rules for reducing/simplifying the program (symbolicexecution)Replace the program by
case distinctions (proof branches) andsequences of updates
3 Rules for handling loopsusing loop invariantsusing induction
4 Rules for replacing a method invocations by the method’scontract
5 Update simplificationBeckert, Ulbrich – Applications of Formal Verification SS 2019 29/44
Components of the Calculus
1 Non-program rulesfirst-order rulesrules for data-typesfirst-order modal rulesinduction rules
2 Rules for reducing/simplifying the program (symbolicexecution)Replace the program by
case distinctions (proof branches) andsequences of updates
3 Rules for handling loopsusing loop invariantsusing induction
4 Rules for replacing a method invocations by the method’scontract
5 Update simplificationBeckert, Ulbrich – Applications of Formal Verification SS 2019 29/44
Components of the Calculus
1 Non-program rulesfirst-order rulesrules for data-typesfirst-order modal rulesinduction rules
2 Rules for reducing/simplifying the program (symbolicexecution)Replace the program by
case distinctions (proof branches) andsequences of updates
3 Rules for handling loopsusing loop invariantsusing induction
4 Rules for replacing a method invocations by the method’scontract
5 Update simplificationBeckert, Ulbrich – Applications of Formal Verification SS 2019 29/44
Components of the Calculus
1 Non-program rulesfirst-order rulesrules for data-typesfirst-order modal rulesinduction rules
2 Rules for reducing/simplifying the program (symbolicexecution)Replace the program by
case distinctions (proof branches) andsequences of updates
3 Rules for handling loopsusing loop invariantsusing induction
4 Rules for replacing a method invocations by the method’scontract
5 Update simplificationBeckert, Ulbrich – Applications of Formal Verification SS 2019 29/44
Components of the Calculus
1 Non-program rulesfirst-order rulesrules for data-typesfirst-order modal rulesinduction rules
2 Rules for reducing/simplifying the program (symbolicexecution)Replace the program by
case distinctions (proof branches) andsequences of updates
3 Rules for handling loopsusing loop invariantsusing induction
4 Rules for replacing a method invocations by the method’scontract
5 Update simplificationBeckert, Ulbrich – Applications of Formal Verification SS 2019 29/44
Loop Invariants
Symbolic execution of loops: unwind
UNWINDLOOPΓ =⇒ U [π if(b) { p; while(b) p} ω]φ,∆
Γ =⇒ U [π while(b) p ω]φ,∆
How to handle a loop with. . .0 iterations? Unwind 1×10 iterations? Unwind 11×10000 iterations? Unwind 10001×(and don’t make any plans for the rest of the day)an unknown number of iterations?
We need an invariant rule (or some other form of induction)
Beckert, Ulbrich – Applications of Formal Verification SS 2019 30/44
Loop Invariants
Symbolic execution of loops: unwind
UNWINDLOOPΓ =⇒ U [π if(b) { p; while(b) p} ω]φ,∆
Γ =⇒ U [π while(b) p ω]φ,∆
How to handle a loop with. . .0 iterations? Unwind 1×10 iterations? Unwind 11×10000 iterations? Unwind 10001×(and don’t make any plans for the rest of the day)an unknown number of iterations?
We need an invariant rule (or some other form of induction)
Beckert, Ulbrich – Applications of Formal Verification SS 2019 30/44
Loop Invariants
Symbolic execution of loops: unwind
UNWINDLOOPΓ =⇒ U [π if(b) { p; while(b) p} ω]φ,∆
Γ =⇒ U [π while(b) p ω]φ,∆
How to handle a loop with. . .0 iterations? Unwind 1×10 iterations? Unwind 11×10000 iterations? Unwind 10001×(and don’t make any plans for the rest of the day)an unknown number of iterations?
We need an invariant rule (or some other form of induction)
Beckert, Ulbrich – Applications of Formal Verification SS 2019 30/44
Loop Invariants
Symbolic execution of loops: unwind
UNWINDLOOPΓ =⇒ U [π if(b) { p; while(b) p} ω]φ,∆
Γ =⇒ U [π while(b) p ω]φ,∆
How to handle a loop with. . .0 iterations? Unwind 1×10 iterations? Unwind 11×10000 iterations? Unwind 10001×(and don’t make any plans for the rest of the day)an unknown number of iterations?
We need an invariant rule (or some other form of induction)
Beckert, Ulbrich – Applications of Formal Verification SS 2019 30/44
Loop Invariants
Symbolic execution of loops: unwind
UNWINDLOOPΓ =⇒ U [π if(b) { p; while(b) p} ω]φ,∆
Γ =⇒ U [π while(b) p ω]φ,∆
How to handle a loop with. . .0 iterations? Unwind 1×10 iterations? Unwind 11×10000 iterations? Unwind 10001×(and don’t make any plans for the rest of the day)an unknown number of iterations?
We need an invariant rule (or some other form of induction)
Beckert, Ulbrich – Applications of Formal Verification SS 2019 30/44
Loop Invariants
Symbolic execution of loops: unwind
UNWINDLOOPΓ =⇒ U [π if(b) { p; while(b) p} ω]φ,∆
Γ =⇒ U [π while(b) p ω]φ,∆
How to handle a loop with. . .0 iterations? Unwind 1×10 iterations? Unwind 11×10000 iterations? Unwind 10001×(and don’t make any plans for the rest of the day)an unknown number of iterations?
We need an invariant rule (or some other form of induction)
Beckert, Ulbrich – Applications of Formal Verification SS 2019 30/44
Loop Invariants
Symbolic execution of loops: unwind
UNWINDLOOPΓ =⇒ U [π if(b) { p; while(b) p} ω]φ,∆
Γ =⇒ U [π while(b) p ω]φ,∆
How to handle a loop with. . .0 iterations? Unwind 1×10 iterations? Unwind 11×10000 iterations? Unwind 10001×(and don’t make any plans for the rest of the day)an unknown number of iterations?
We need an invariant rule (or some other form of induction)
Beckert, Ulbrich – Applications of Formal Verification SS 2019 30/44
Loop Invariants
Symbolic execution of loops: unwind
UNWINDLOOPΓ =⇒ U [π if(b) { p; while(b) p} ω]φ,∆
Γ =⇒ U [π while(b) p ω]φ,∆
How to handle a loop with. . .0 iterations? Unwind 1×10 iterations? Unwind 11×10000 iterations? Unwind 10001×(and don’t make any plans for the rest of the day)an unknown number of iterations?
We need an invariant rule (or some other form of induction)
Beckert, Ulbrich – Applications of Formal Verification SS 2019 30/44
Loop Invariants
Symbolic execution of loops: unwind
UNWINDLOOPΓ =⇒ U [π if(b) { p; while(b) p} ω]φ,∆
Γ =⇒ U [π while(b) p ω]φ,∆
How to handle a loop with. . .0 iterations? Unwind 1×10 iterations? Unwind 11×10000 iterations? Unwind 10001×(and don’t make any plans for the rest of the day)an unknown number of iterations?
We need an invariant rule (or some other form of induction)
Beckert, Ulbrich – Applications of Formal Verification SS 2019 30/44
Loop Invariants Cont’d
Idea behind loop invariantsA formula Inv that
holds initially andwhose validity is preserved by loop iteration
Consequence: if Inv was valid at start of the loop, then itstill holds after arbitrarily many loop iterationsIf the loop terminates at all, then Inv holds afterwardsMake Inv strong enough to entail the desired postcondition
Basic Invariant Rule
loopInvariant
Γ =⇒ U Inv ,∆ (initially valid)Inv , b .
= TRUE =⇒ [p]Inv (preserved)Inv , b .
= FALSE =⇒ [π ω]φ (use case)Γ =⇒ U [π while(b) p ω]φ,∆
Beckert, Ulbrich – Applications of Formal Verification SS 2019 31/44
Loop Invariants Cont’d
Idea behind loop invariantsA formula Inv that
holds initially andwhose validity is preserved by loop iteration
Consequence: if Inv was valid at start of the loop, then itstill holds after arbitrarily many loop iterationsIf the loop terminates at all, then Inv holds afterwardsMake Inv strong enough to entail the desired postcondition
Basic Invariant Rule
loopInvariant
Γ =⇒ U Inv ,∆ (initially valid)Inv , b .
= TRUE =⇒ [p]Inv (preserved)Inv , b .
= FALSE =⇒ [π ω]φ (use case)Γ =⇒ U [π while(b) p ω]φ,∆
Beckert, Ulbrich – Applications of Formal Verification SS 2019 31/44
Loop Invariants Cont’d
Idea behind loop invariantsA formula Inv that
holds initially andwhose validity is preserved by loop iteration
Consequence: if Inv was valid at start of the loop, then itstill holds after arbitrarily many loop iterationsIf the loop terminates at all, then Inv holds afterwardsMake Inv strong enough to entail the desired postcondition
Basic Invariant Rule
loopInvariant
Γ =⇒ U Inv ,∆ (initially valid)Inv , b .
= TRUE =⇒ [p]Inv (preserved)Inv , b .
= FALSE =⇒ [π ω]φ (use case)Γ =⇒ U [π while(b) p ω]φ,∆
Beckert, Ulbrich – Applications of Formal Verification SS 2019 31/44
Loop Invariants Cont’d
Idea behind loop invariantsA formula Inv that
holds initially andwhose validity is preserved by loop iteration
Consequence: if Inv was valid at start of the loop, then itstill holds after arbitrarily many loop iterationsIf the loop terminates at all, then Inv holds afterwardsMake Inv strong enough to entail the desired postcondition
Basic Invariant Rule
loopInvariant
Γ =⇒ U Inv ,∆ (initially valid)Inv , b .
= TRUE =⇒ [p]Inv (preserved)Inv , b .
= FALSE =⇒ [π ω]φ (use case)Γ =⇒ U [π while(b) p ω]φ,∆
Beckert, Ulbrich – Applications of Formal Verification SS 2019 31/44
Loop Invariants Cont’d
Idea behind loop invariantsA formula Inv that
holds initially andwhose validity is preserved by loop iteration
Consequence: if Inv was valid at start of the loop, then itstill holds after arbitrarily many loop iterationsIf the loop terminates at all, then Inv holds afterwardsMake Inv strong enough to entail the desired postcondition
Basic Invariant Rule
loopInvariant
Γ =⇒ U Inv ,∆ (initially valid)Inv , b .
= TRUE =⇒ [p]Inv (preserved)Inv , b .
= FALSE =⇒ [π ω]φ (use case)Γ =⇒ U [π while(b) p ω]φ,∆
Beckert, Ulbrich – Applications of Formal Verification SS 2019 31/44
Loop Invariants Cont’d
Basic Invariant Rule: Problem
loopInvariant
Γ =⇒ U Inv ,∆ (initially valid)Inv , b .
= TRUE =⇒ [p]Inv (preserved)Inv , b .
= FALSE =⇒ [π ω]φ (use case)Γ =⇒ U [π while(b) p ω]φ,∆
Context Γ, ∆, U must be omitted in 2nd and 3rd premiseBut: context contains (part of) precondition and classinvariantsRequired context information must be added to loopinvariant Inv
Beckert, Ulbrich – Applications of Formal Verification SS 2019 32/44
Loop Invariants Cont’d
Basic Invariant Rule: Problem
loopInvariant
Γ =⇒ U Inv ,∆ (initially valid)Inv , b .
= TRUE =⇒ [p]Inv (preserved)Inv , b .
= FALSE =⇒ [π ω]φ (use case)Γ =⇒ U [π while(b) p ω]φ,∆
Context Γ, ∆, U must be omitted in 2nd and 3rd premiseBut: context contains (part of) precondition and classinvariantsRequired context information must be added to loopinvariant Inv
Beckert, Ulbrich – Applications of Formal Verification SS 2019 32/44
Loop Invariants Cont’d
Basic Invariant Rule: Problem
loopInvariant
Γ =⇒ U Inv ,∆ (initially valid)Inv , b .
= TRUE =⇒ [p]Inv (preserved)Inv , b .
= FALSE =⇒ [π ω]φ (use case)Γ =⇒ U [π while(b) p ω]φ,∆
Context Γ, ∆, U must be omitted in 2nd and 3rd premiseBut: context contains (part of) precondition and classinvariantsRequired context information must be added to loopinvariant Inv
Beckert, Ulbrich – Applications of Formal Verification SS 2019 32/44
Loop Invariants Cont’d
Basic Invariant Rule: Problem
loopInvariant
Γ =⇒ U Inv ,∆ (initially valid)Inv , b .
= TRUE =⇒ [p]Inv (preserved)Inv , b .
= FALSE =⇒ [π ω]φ (use case)Γ =⇒ U [π while(b) p ω]φ,∆
Context Γ, ∆, U must be omitted in 2nd and 3rd premiseBut: context contains (part of) precondition and classinvariantsRequired context information must be added to loopinvariant Inv
Beckert, Ulbrich – Applications of Formal Verification SS 2019 32/44
Example
Precondition: a 6 .= null
& ClassInv
int i = 0;while(i < a.length) {
a[i] = 1;i++;
}
Postcondition: ∀int x ; (0 ≤ x < a.length→ a[x] .= 1)
Loop invariant: 0 ≤ i ∧ i ≤ a.length
∧ ∀int x ; (0 ≤ x < i→ a[x] .= 1)
∧ a 6 .= null∧ ClassInv ′
Beckert, Ulbrich – Applications of Formal Verification SS 2019 33/44
Example
Precondition: a 6 .= null
& ClassInv
int i = 0;while(i < a.length) {
a[i] = 1;i++;
}
Postcondition: ∀int x ; (0 ≤ x < a.length→ a[x] .= 1)
Loop invariant: 0 ≤ i ∧ i ≤ a.length
∧ ∀int x ; (0 ≤ x < i→ a[x] .= 1)
∧ a 6 .= null∧ ClassInv ′
Beckert, Ulbrich – Applications of Formal Verification SS 2019 33/44
Example
Precondition: a 6 .= null
& ClassInv
int i = 0;while(i < a.length) {
a[i] = 1;i++;
}
Postcondition: ∀int x ; (0 ≤ x < a.length→ a[x] .= 1)
Loop invariant: 0 ≤ i ∧ i ≤ a.length
∧ ∀int x ; (0 ≤ x < i→ a[x] .= 1)
∧ a 6 .= null∧ ClassInv ′
Beckert, Ulbrich – Applications of Formal Verification SS 2019 33/44
Example
Precondition: a 6 .= null
& ClassInv
int i = 0;while(i < a.length) {
a[i] = 1;i++;
}
Postcondition: ∀int x ; (0 ≤ x < a.length→ a[x] .= 1)
Loop invariant: 0 ≤ i ∧ i ≤ a.length
∧ ∀int x ; (0 ≤ x < i→ a[x] .= 1)
∧ a 6 .= null∧ ClassInv ′
Beckert, Ulbrich – Applications of Formal Verification SS 2019 33/44
Example
Precondition: a 6 .= null
& ClassInv
int i = 0;while(i < a.length) {
a[i] = 1;i++;
}
Postcondition: ∀int x ; (0 ≤ x < a.length→ a[x] .= 1)
Loop invariant: 0 ≤ i ∧ i ≤ a.length∧ ∀int x ; (0 ≤ x < i→ a[x] .
= 1)
∧ a 6 .= null∧ ClassInv ′
Beckert, Ulbrich – Applications of Formal Verification SS 2019 33/44
Example
Precondition: a 6 .= null
& ClassInv
int i = 0;while(i < a.length) {
a[i] = 1;i++;
}
Postcondition: ∀int x ; (0 ≤ x < a.length→ a[x] .= 1)
Loop invariant: 0 ≤ i ∧ i ≤ a.length∧ ∀int x ; (0 ≤ x < i→ a[x] .
= 1)∧ a 6 .= null
∧ ClassInv ′
Beckert, Ulbrich – Applications of Formal Verification SS 2019 33/44
Example
Precondition: a 6 .= null & ClassInv
int i = 0;while(i < a.length) {
a[i] = 1;i++;
}
Postcondition: ∀int x ; (0 ≤ x < a.length→ a[x] .= 1)
Loop invariant: 0 ≤ i ∧ i ≤ a.length∧ ∀int x ; (0 ≤ x < i→ a[x] .
= 1)∧ a 6 .= null∧ ClassInv ′
Beckert, Ulbrich – Applications of Formal Verification SS 2019 33/44
Keeping the Context
Want to keep part of the context that is unmodified by loopassignable clauses for loops can tell what might bemodified
@ assignable i, a[*];
Beckert, Ulbrich – Applications of Formal Verification SS 2019 34/44
Keeping the Context
Want to keep part of the context that is unmodified by loopassignable clauses for loops can tell what might bemodified
@ assignable i, a[*];
Beckert, Ulbrich – Applications of Formal Verification SS 2019 34/44
Example with Improved InvariantRule
Precondition: a 6 .= null
& ClassInv
int i = 0;while(i < a.length) {
a[i] = 1;i++;
}
Postcondition: ∀int x ; (0 ≤ x < a.length→ a[x] .= 1)
Loop invariant: 0 ≤ i ∧ i ≤ a.length
∧ ∀int x ; (0 ≤ x < i→ a[x] .= 1)
Beckert, Ulbrich – Applications of Formal Verification SS 2019 35/44
Example with Improved InvariantRule
Precondition: a 6 .= null
& ClassInv
int i = 0;while(i < a.length) {
a[i] = 1;i++;
}
Postcondition: ∀int x ; (0 ≤ x < a.length→ a[x] .= 1)
Loop invariant: 0 ≤ i ∧ i ≤ a.length
∧ ∀int x ; (0 ≤ x < i→ a[x] .= 1)
Beckert, Ulbrich – Applications of Formal Verification SS 2019 35/44
Example with Improved InvariantRule
Precondition: a 6 .= null
& ClassInv
int i = 0;while(i < a.length) {
a[i] = 1;i++;
}
Postcondition: ∀int x ; (0 ≤ x < a.length→ a[x] .= 1)
Loop invariant: 0 ≤ i ∧ i ≤ a.length
∧ ∀int x ; (0 ≤ x < i→ a[x] .= 1)
Beckert, Ulbrich – Applications of Formal Verification SS 2019 35/44
Example with Improved InvariantRule
Precondition: a 6 .= null
& ClassInv
int i = 0;while(i < a.length) {
a[i] = 1;i++;
}
Postcondition: ∀int x ; (0 ≤ x < a.length→ a[x] .= 1)
Loop invariant: 0 ≤ i ∧ i ≤ a.length
∧ ∀int x ; (0 ≤ x < i→ a[x] .= 1)
Beckert, Ulbrich – Applications of Formal Verification SS 2019 35/44
Example with Improved InvariantRule
Precondition: a 6 .= null
& ClassInv
int i = 0;while(i < a.length) {
a[i] = 1;i++;
}
Postcondition: ∀int x ; (0 ≤ x < a.length→ a[x] .= 1)
Loop invariant: 0 ≤ i ∧ i ≤ a.length∧ ∀int x ; (0 ≤ x < i→ a[x] .
= 1)
Beckert, Ulbrich – Applications of Formal Verification SS 2019 35/44
Example with Improved InvariantRule
Precondition: a 6 .= null
& ClassInv
int i = 0;while(i < a.length) {
a[i] = 1;i++;
}
Postcondition: ∀int x ; (0 ≤ x < a.length→ a[x] .= 1)
Loop invariant: 0 ≤ i ∧ i ≤ a.length∧ ∀int x ; (0 ≤ x < i→ a[x] .
= 1)
Beckert, Ulbrich – Applications of Formal Verification SS 2019 35/44
Example with Improved InvariantRule
Precondition: a 6 .= null & ClassInv
int i = 0;while(i < a.length) {
a[i] = 1;i++;
}
Postcondition: ∀int x ; (0 ≤ x < a.length→ a[x] .= 1)
Loop invariant: 0 ≤ i ∧ i ≤ a.length∧ ∀int x ; (0 ≤ x < i→ a[x] .
= 1)
Beckert, Ulbrich – Applications of Formal Verification SS 2019 35/44
Example in JML/Java – Loop.java
public int[] a;/*@ public normal_behavior@ ensures (\forall int x; 0<=x && x<a.length; a[x]==1);@ diverges true;@*/
public void m() {int i = 0;/*@ loop_invariant@ (0 <= i && i <= a.length &&@ (\forall int x; 0<=x && x<i; a[x]==1));@ assignable i, a[*];@*/
while(i < a.length) {a[i] = 1;i++;
}}
Beckert, Ulbrich – Applications of Formal Verification SS 2019 36/44
Example∀ int x ;
(n.
= x ∧ x >= 0→[ i = 0; r = 0;while (i<n) { i = i + 1; r = r + i;}r=r+r-n;
]r.
=?)
How can we prove that the above formula is valid(i.e., satisfied in all states)?
Solution:@ loop_invariant@ i>=0 && 2*r == i*(i + 1) && i <= n;@ assignable i, r;
File: Loop2.java
Beckert, Ulbrich – Applications of Formal Verification SS 2019 37/44
Example∀ int x ;
(n.
= x ∧ x >= 0→[ i = 0; r = 0;while (i<n) { i = i + 1; r = r + i;}r=r+r-n;
]r.
= x ∗ x)
How can we prove that the above formula is valid(i.e., satisfied in all states)?
Solution:@ loop_invariant@ i>=0 && 2*r == i*(i + 1) && i <= n;@ assignable i, r;
File: Loop2.java
Beckert, Ulbrich – Applications of Formal Verification SS 2019 37/44
Example∀ int x ;
(n.
= x ∧ x >= 0→[ i = 0; r = 0;while (i<n) { i = i + 1; r = r + i;}r=r+r-n;
]r.
= x ∗ x)
How can we prove that the above formula is valid(i.e., satisfied in all states)?
Solution:@ loop_invariant@ i>=0 && 2*r == i*(i + 1) && i <= n;@ assignable i, r;
File: Loop2.java
Beckert, Ulbrich – Applications of Formal Verification SS 2019 37/44
Example∀ int x ;
(n.
= x ∧ x >= 0→[ i = 0; r = 0;while (i<n) { i = i + 1; r = r + i;}r=r+r-n;
]r.
= x ∗ x)
How can we prove that the above formula is valid(i.e., satisfied in all states)?
Solution:@ loop_invariant@ i>=0 && 2*r == i*(i + 1) && i <= n;@ assignable i, r;
File: Loop2.java
Beckert, Ulbrich – Applications of Formal Verification SS 2019 37/44
HintsProving assignable
The invariant rule on the slides assumes that assignableis correct. With assignable \nothing; e.g., one canprove nonsenseThe invariant rule in KeY generates proof obligation thatensures correctness of assignable
Setting in the KeY Prover when proving loopsLoop treatment: InvariantQuantifier treatment: No Splits with ProgsIf program contains *, /:Arithmetic treatment: DefOpsIs search limit high enough (time out, rule apps.)?When proving partial correctness, add diverges true;
Beckert, Ulbrich – Applications of Formal Verification SS 2019 38/44
HintsProving assignable
The invariant rule on the slides assumes that assignableis correct. With assignable \nothing; e.g., one canprove nonsenseThe invariant rule in KeY generates proof obligation thatensures correctness of assignable
Setting in the KeY Prover when proving loopsLoop treatment: InvariantQuantifier treatment: No Splits with ProgsIf program contains *, /:Arithmetic treatment: DefOpsIs search limit high enough (time out, rule apps.)?When proving partial correctness, add diverges true;
Beckert, Ulbrich – Applications of Formal Verification SS 2019 38/44
Total Correctness
Find a decreasing integer term v (called variant)Add the following premisses to the invariant rule:
v ≥ 0 is initially validv ≥ 0 is preserved by the loop bodyv is strictly decreased by the loop body
Proving termination in JML/JavaRemove directive diverges true;
Add directive decreasing v; to loop invariantKeY creates suitable invariant rule and PO (with 〈...〉φ)
Example: The array loop
@ decreasing
a.length - i;
Files:LoopT.java
Loop2T.java
Beckert, Ulbrich – Applications of Formal Verification SS 2019 39/44
Total Correctness
Find a decreasing integer term v (called variant)Add the following premisses to the invariant rule:
v ≥ 0 is initially validv ≥ 0 is preserved by the loop bodyv is strictly decreased by the loop body
Proving termination in JML/JavaRemove directive diverges true;
Add directive decreasing v; to loop invariantKeY creates suitable invariant rule and PO (with 〈...〉φ)
Example: The array loop
@ decreasing
a.length - i;
Files:LoopT.java
Loop2T.java
Beckert, Ulbrich – Applications of Formal Verification SS 2019 39/44
Total Correctness
Find a decreasing integer term v (called variant)Add the following premisses to the invariant rule:
v ≥ 0 is initially validv ≥ 0 is preserved by the loop bodyv is strictly decreased by the loop body
Proving termination in JML/JavaRemove directive diverges true;
Add directive decreasing v; to loop invariantKeY creates suitable invariant rule and PO (with 〈...〉φ)
Example: The array loop
@ decreasing
a.length - i;
Files:LoopT.java
Loop2T.java
Beckert, Ulbrich – Applications of Formal Verification SS 2019 39/44
Total Correctness
Find a decreasing integer term v (called variant)Add the following premisses to the invariant rule:
v ≥ 0 is initially validv ≥ 0 is preserved by the loop bodyv is strictly decreased by the loop body
Proving termination in JML/JavaRemove directive diverges true;
Add directive decreasing v; to loop invariantKeY creates suitable invariant rule and PO (with 〈...〉φ)
Example: The array loop
@ decreasing a.length - i;
Files:LoopT.java
Loop2T.java
Beckert, Ulbrich – Applications of Formal Verification SS 2019 39/44
Total Correctness
Find a decreasing integer term v (called variant)Add the following premisses to the invariant rule:
v ≥ 0 is initially validv ≥ 0 is preserved by the loop bodyv is strictly decreased by the loop body
Proving termination in JML/JavaRemove directive diverges true;
Add directive decreasing v; to loop invariantKeY creates suitable invariant rule and PO (with 〈...〉φ)
Example: The array loop
@ decreasing a.length - i;
Files:LoopT.java
Loop2T.java
Beckert, Ulbrich – Applications of Formal Verification SS 2019 39/44
Side effects in loop guards
Find a postcondition:
int x, y;// ...while( x-- != ++y );
Note: Loop guards may have side effects.Hence: Evaluate them in a modality.
Invariant rule with side effects
sideEffectLI
Γ =⇒ U Inv ,∆ (initially valid)Inv , b .
= TRUE < 4 > [x=b;]x .= TRUE =⇒ [p]Inv (preserved)
Inv , b .= FALSE =⇒ [π ω]φ (use case)
Γ =⇒ U [π while(b) p ω]φ,∆
Beckert, Ulbrich – Applications of Formal Verification SS 2019 40/44
Side effects in loop guards
Find a postcondition:
int x, y;// ...while( x-- != ++y );
Note: Loop guards may have side effects.Hence: Evaluate them in a modality.
Invariant rule with side effects
sideEffectLI
Γ =⇒ U Inv ,∆ (initially valid)Inv , b .
= TRUE < 4 > [x=b;]x .= TRUE =⇒ [p]Inv (preserved)
Inv , b .= FALSE =⇒ [π ω]φ (use case)
Γ =⇒ U [π while(b) p ω]φ,∆
Beckert, Ulbrich – Applications of Formal Verification SS 2019 40/44
Side effects in loop guards
Find a postcondition:
int x, y;// ...while( x-- != ++y );
Note: Loop guards may have side effects.Hence: Evaluate them in a modality.
Invariant rule with side effects
sideEffectLI
Γ =⇒ U Inv ,∆ (initially valid)Inv , b .
= TRUE < 4 > [x=b;]x .= TRUE =⇒ [p]Inv (preserved)
Inv , b .= FALSE =⇒ [π ω]φ (use case)
Γ =⇒ U [π while(b) p ω]φ,∆
Beckert, Ulbrich – Applications of Formal Verification SS 2019 40/44
Side effects in loop guards
Find a postcondition:
int x, y;// ...while( x-- != ++y );
Note: Loop guards may have side effects.Hence: Evaluate them in a modality.
Invariant rule with side effects
sideEffectLI
Γ =⇒ U Inv ,∆ (initially valid)Inv , [x=b;]x .
= TRUE =⇒ [p]Inv (preserved)Inv , [x=b;]x .
= FALSE =⇒ [π ω]φ (use case)Γ =⇒ U [π while(b) p ω]φ,∆
Beckert, Ulbrich – Applications of Formal Verification SS 2019 40/44
Side effects in loop guards
Find a postcondition:
int x, y;// ...while( x-- != ++y );
Note: Loop guards may have side effects.Hence: Evaluate them in a modality.
Invariant rule with side effects
sideEffectLI
Γ =⇒ U Inv ,∆ (initially valid)Inv , [x=b;]x .
= TRUE =⇒ [x=b;p]Inv (preserved)Inv , [x=b;]x .
= FALSE =⇒ [π ω]φ (use case)Γ =⇒ U [π while(b) p ω]φ,∆
Beckert, Ulbrich – Applications of Formal Verification SS 2019 40/44
Loops and Abrupt Completion
Rule loopInvariant requires normal, structural control flow(loop body always fully executed; run continues after loop)
Non-structural control flow in Java
return break continue throw
make loop body terminate abruptly.
SolutionTransform non-standard control flow into standard control-flowand with marker variables.
Beckert, Ulbrich – Applications of Formal Verification SS 2019 41/44
Loops and Abrupt Completion
Original loop body p
if(x == 0) break;
if(x == 1) return 42;
if(x == 2) continue;if(x == 3) throw e;if(x == 4) x = -1;
Encoded loop body p
loopBody: { try {BREAK = RETURN = false;EXCEPTION = null;if(x == 0) { BREAK=true;break loopBody; }
if(x == 1) { res=42;RETURN=true;break loopBody; }
if(x == 2) break loopBody;if(x == 3) throw e;if(x == 4) x = -1;
} catch(Throwable e) { EXC = e; }}
Beckert, Ulbrich – Applications of Formal Verification SS 2019 42/44
Loops and Abrupt Completion
Original loop body p
if(x == 0) break;
if(x == 1) return 42;
if(x == 2) continue;if(x == 3) throw e;if(x == 4) x = -1;
Encoded loop body p
loopBody: { try {BREAK = RETURN = false;EXCEPTION = null;if(x == 0) { BREAK=true;break loopBody; }
if(x == 1) { res=42;RETURN=true;break loopBody; }
if(x == 2) break loopBody;if(x == 3) throw e;if(x == 4) x = -1;
} catch(Throwable e) { EXC = e; }}
Beckert, Ulbrich – Applications of Formal Verification SS 2019 42/44
Loops and Abrupt Termination
Invariant rule with abrupt termination (using translation · )
loopInvariant
Γ =⇒ U Inv ,∆ (initially valid)Inv , b .
= TRUE =⇒ [p]Inv (preserved)Inv , b .
= FALSE =⇒ [π ω]φ (use case)Γ =⇒ U [π while(b) p ω]φ,∆
where ψ is the formula
(EXC 6 .= null→ [π throw EXCEPTION; ω]ϕ)∧ (BREAK
.= TRUE→ [π ω]φ)
∧ (RETURN = TRUE→ [π return res; ω]φ)∧ (NORMAL → Inv)
with NORMAL ≡ BREAK.= FALSE ∧ RETURN
.= FALSE ∧ EXC
.= null
Beckert, Ulbrich – Applications of Formal Verification SS 2019 43/44
Loops and Abrupt Termination
Invariant rule with abrupt termination (using translation · )
loopInvariant
Γ =⇒ U Inv ,∆ (initially valid)Inv , b .
= TRUE =⇒ [p]ψ (preserved)Inv , b .
= FALSE =⇒ [π ω]φ (use case)Γ =⇒ U [π while(b) p ω]φ,∆
where ψ is the formula
(EXC 6 .= null→ [π throw EXCEPTION; ω]ϕ)∧ (BREAK
.= TRUE→ [π ω]φ)
∧ (RETURN = TRUE→ [π return res; ω]φ)∧ (NORMAL → Inv)
with NORMAL ≡ BREAK.= FALSE ∧ RETURN
.= FALSE ∧ EXC
.= null
Beckert, Ulbrich – Applications of Formal Verification SS 2019 43/44
Loop Invariant – Conclusion
Is a difficult subject.shows that real prog language is a challengeMany technical non-trivial tricks.A rule that puts together
1 considering assignable clauses2 side effects in loop guards3 abrupt termination
is in chapter 3.Further reading: KeY book Ch. 15 ??New developments: Loop scope rule, Loop contracts
Beckert, Ulbrich – Applications of Formal Verification SS 2019 44/44
top related